---
- name: Disable SSH password authentication
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?PasswordAuthentication'
    line: 'PasswordAuthentication no'
    state: present
  notify: restart ssh

- name: Ensure SSH directory exists
  file:
    path: /root/.ssh
    state: directory
    mode: '0700'

- name: Add SSH public keys for root access
  authorized_key:
    user: root
    key: "{{ item }}"
    state: present
  loop: "{{ ssh_public_keys }}"